him[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
him.exe
Size 913KB
Sample260812-xsrcvadl2s
SHA256 b5243e6917b79bd612083f868ed39aae5e29e5ebd9291d016ea9fe2d05c501ec
MD5 ec4412ebad1942bba97a80541e76ffb9
SHA1 4c298cf81b74c8d1ad4d3e8f1a7672431c6c85a3
SHA512 42185d2f741c8ab08423d49575b4e79b3f058072662c5caa3ee28f24651cd93a1434a70a7fb1cd03cc51ab8b8629ed9ce96aa327fb6e17cc18216b6d630f46d7
SSDEEP 12288:+FE+jgDp4CrnNY2MMZEjvfO1rN+W2I8PnT4VZNXuSjf6DmWVaNNRpLl:+FBMDp4ZRMZEjXtI8iD9NNRpLl
TLSH
T1B215294326D71CEADD932B78A5DB6339AB35FD708B7A8A6B4508C1316C131D0AE2F711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
him.exe

File Explorer

him.exe

.exe 913KB

him.exe

IMPHASH abe0c3ca89f3674fad2f3e494a26abc3
SHA256 b5243e6917b79bd612083f868ed39aae5e29e5ebd9291d016ea9fe2d05c501ec
MD5 ec4412ebad1942bba97a80541e76ffb9
SHA1 4c298cf81b74c8d1ad4d3e8f1a7672431c6c85a3
SHA512 42185d2f741c8ab08423d49575b4e79b3f058072662c5caa3ee28f24651cd93a1434a70a7fb1cd03cc51ab8b8629ed9ce96aa327fb6e17cc18216b6d630f46d7
SSDEEP 12288:+FE+jgDp4CrnNY2MMZEjvfO1rN+W2I8PnT4VZNXuSjf6DmWVaNNRpLl:+FBMDp4ZRMZEjXtI8iD9NNRpLl
TLSH
T1B215294326D71CEADD932B78A5DB6339AB35FD708B7A8A6B4508C1316C131D0AE2F711
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5088

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

GetUserNameA

gdi32

BitBlt CreateCompatibleBitmap CreateCompatibleDC DeleteDC DeleteObject GetDIBits SelectObject

kernel32

Beep CloseHandle CreateFileW CreateProcessA CreateThread CreateToolhelp32Snapshot DeleteCriticalSection DeleteFileA DeleteFileW EnterCriticalSection GetComputerNameA GetCurrentDirectoryA GetFileSize GetLastError GetModuleHandleW GetProcAddress GetStartupInfoW GetSystemInfo GetTempFileNameA GetTempPathA GetThreadId GetVersion GlobalLock GlobalMemoryStatusEx GlobalUnlock InitializeCriticalSection IsDBCSLeadByteEx LeaveCriticalSection LoadLibraryW MultiByteToWideChar OpenProcess Process32FirstW Process32NextW RaiseException ReadFile RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetCurrentDirectoryW SetLastError SetUnhandledExceptionFilter Sleep TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue TryEnterCriticalSection VirtualProtect VirtualQuery WaitForSingleObject WideCharToMultiByte WriteFile

msvcrt

__C_specific_handler ___lc_codepage_func ___mb_cur_max_func __iob_func __set_app_type __setusermatherr __wgetmainargs __winitenv _amsg_exit _cexit _commode _errno _fmode _initterm _onexit _wcmdln abort calloc exit fprintf fputc fputs free fwrite getc getenv isspace isxdigit localeconv malloc memchr memcmp memcpy memmove memset realloc signal strchr strcmp strerror strlen strncmp strtol strtoul tolower ungetc vfprintf wcslen _strtoui64 _strtoi64 _read

shell32

ShellExecuteW

urlmon

URLDownloadToFileW

user32

CallNextHookEx CloseClipboard DispatchMessageW ExitWindowsEx GetClipboardData GetDC GetKeyboardState GetMessageW GetSystemMetrics LockWorkStation MessageBoxW OpenClipboard ReleaseDC SetWindowsHookExW ToAscii TranslateMessage UnhookWindowsHookEx

winhttp

WinHttpAddRequestHeaders WinHttpCloseHandle WinHttpConnect WinHttpOpen WinHttpOpenRequest WinHttpQueryDataAvailable WinHttpReadData WinHttpReceiveResponse WinHttpSendRequest

Name

.text

Size

210KB

Virtual Size

210KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

576B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

21KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

14KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

15KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

96B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

1024B

Virtual Size

1012B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/19

Size

115KB

Virtual Size

114KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/31

Size

18KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/45

Size

53KB

Virtual Size

52KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/57

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/70

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/81

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/97

Size

68KB

Virtual Size

67KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/113

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

him.exe

advapi32

gdi32

kernel32

msvcrt

shell32

urlmon

user32

winhttp

generic